Invalid version request parameter to S3 storage for static files #11243

Closed
opened 2025-12-29 21:42:23 +01:00 by adam · 2 comments
Owner

Originally created by @dominikspiertz on GitHub (May 30, 2025).

Originally assigned to: @arthanson on GitHub.

Deployment Type

Self-hosted

NetBox Version

v4.3.1

Python Version

3.12

Steps to Reproduce

  1. Configure Netbox to use S3 object storage for static files
  2. Access the Netbox instance, trying to fetch static files to serve the application

Expected Behavior

Netbox should create requests to the S3 storage backend for fetching static files using valid query parameters.

Observed Behavior

Netbox attaches a query parameter with the application version using the wrong delimiter. This is the request:

https://s3.netbox.tld/files/setmode.js?AWSAccessKeyId=key&Signature=123&Expires=1748635659?v=4.3.1
See how it attaches ?v=4.3.1 at the end. When in fact it need to be &v=4.3.1

However this only happens when I try to load Netbox application. When I am on the "Static Media Failure" site, it provides a link that it cannot load the file "setmode.js". If I click there, the link works fine:
https://s3.netbox.tld/files/setmode.js?AWSAccessKeyId=key&Signature=123&Expires=1748635660

Originally created by @dominikspiertz on GitHub (May 30, 2025). Originally assigned to: @arthanson on GitHub. ### Deployment Type Self-hosted ### NetBox Version v4.3.1 ### Python Version 3.12 ### Steps to Reproduce 1. Configure Netbox to use S3 object storage for static files 2. Access the Netbox instance, trying to fetch static files to serve the application ### Expected Behavior Netbox should create requests to the S3 storage backend for fetching static files using valid query parameters. ### Observed Behavior Netbox attaches a query parameter with the application version using the wrong delimiter. This is the request: `https://s3.netbox.tld/files/setmode.js?AWSAccessKeyId=key&Signature=123&Expires=1748635659?v=4.3.1` See how it attaches `?v=4.3.1` at the end. When in fact it need to be `&v=4.3.1` However this only happens when I try to load Netbox application. When I am on the "Static Media Failure" site, it provides a link that it cannot load the file "setmode.js". If I click there, the link works fine: `https://s3.netbox.tld/files/setmode.js?AWSAccessKeyId=key&Signature=123&Expires=1748635660`
adam added the type: bugstatus: acceptedseverity: medium labels 2025-12-29 21:42:23 +01:00
adam closed this issue 2025-12-29 21:42:23 +01:00
Author
Owner

@jeremystretch commented on GitHub (Jun 2, 2025):

The issue appears to be the way we attach the version designation to the URL in the template:

<script src="{% static 'setmode.js' %}?v={{ settings.RELEASE.version }}" ...>

AFAIK Django's static tag doesn't allow for the inclusion of additional query parameters. Not sure what the best fix would be; we might need to override the stock tag to inspect the URL.

@jeremystretch commented on GitHub (Jun 2, 2025): The issue appears to be the way we attach the version designation to the URL in the template: ``` <script src="{% static 'setmode.js' %}?v={{ settings.RELEASE.version }}" ...> ``` AFAIK Django's [`static` tag](https://docs.djangoproject.com/en/5.2/ref/templates/builtins/#std-templatetag-static) doesn't allow for the inclusion of additional query parameters. Not sure what the best fix would be; we might need to override the stock tag to inspect the URL.
Author
Owner

@arthanson commented on GitHub (Sep 30, 2025):

@dominikspiertz would you be able to test PR https://github.com/netbox-community/netbox/pull/20455 it should hopefully fix this issue.

@arthanson commented on GitHub (Sep 30, 2025): @dominikspiertz would you be able to test PR https://github.com/netbox-community/netbox/pull/20455 it should hopefully fix this issue.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#11243